ClickHouse MCP Server vs PlanetScale MCP Server

ClickHouse MCP Server

Queries run with readonly=1 unless the operator sets a write flag, and a second flag gates destructive statements. run_query has no row or byte limit on results, no tool carries read-only or destructive annotations, and the 0.3.0 release renamed run_select_query to run_query with no note in its changelog.

PlanetScale MCP Server

OAuth scopes set no, read-only or full database access per organisation or database, each query runs on a credential created and deleted for that call, and an insights-only endpoint drops both SQL tools. Destructive statements are gated by a flag the model sets itself, no rate limit was found, and every plan needs a card.

ClickHouse MCP Server

1. Put a LIMIT on every run_query call. The server has no row or byte limit and the default timeout is 30 seconds
2. Call the tool run_query. ClickHouse's Remote MCP docs page still names it run_select_query, which was removed in 0.3.0
3. Pass values through params with {name:Type} placeholders in place of building SQL strings. Tuple and Map types can't be bound
4. Set include_detailed_columns to false on list_tables for wide schemas. Page tokens are single-use and expire after one hour
5. Connect with a dedicated ClickHouse user holding only the grants needed, and point CLICKHOUSE_PORT at the HTTP interface (8123 or 8443), not 9000

PlanetScale MCP Server

1. Use https://mcp.pscale.dev/mcp/planetscale-insights-only when the task needs no SQL. It omits both query tools
2. Pass organization, database and branch on every query call. Record them in AGENTS.md to skip the listing calls
3. Show the person the exact DELETE or DDL statement and get approval before setting confirm_destructive: true
4. Keep queries under 50 seconds and add your own LIMIT. The query tools cancel at 50 seconds and return every row
5. For a service token send Authorization: Bearer pscale_tkn_... with the secret only. The id:secret form is rejected